0f3c60daa3a6301cf425a902eca62e87735299b9de4d309fe0c6abb39f85f5d2

Analysis

max time kernel
148s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
Size 6.8MB
Sample260810-df95mszenc
SHA256 0f3c60daa3a6301cf425a902eca62e87735299b9de4d309fe0c6abb39f85f5d2
MD5 1b38040ec356ad9303b54fd7c48b672c
SHA1 f3f6c66ff5aae8a89766c2e0f9884a03d3be4fb1
SHA512 c4e91376e755a0bb073569ac07cf157199a5cdff9e43ff1fced794784fa787478687a8b389b7e29419666f346c38a70c70a53e63699cde82c1bf4c868706f1ff
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+ELhOO+EF+Ei+EF+Ei+EF+ELhOO+EF+Ei+EF+Ei+EF+ELhOH:evvvvvvvva
TLSH
T186763A0DF99704F1D937517048DBD2BA8931793187218EEFF689C63EA933B91A838B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
2088	svchost_ACBABCABBABCAACBCABAAACCBCCCBCBCACCACCBCCACBCCACCCAAACC.exe
2044	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBACABCCACABACACBCBAACCBCCBAAAABCCBAAAAAACABBAAAABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe"	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBBABBBCACCBCBBCAAAAABBAACCAAABACACBAAACBCBCCACBBBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABCABBABCAACBCABAAACCBCCCBCBCACCACCBCCACBCCACCCAAACC.exe"	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1556	sc.exe
4492	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2344	cmd.exe
2724	cmd.exe
4220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABCABBABCAACBCABAAACCBCCCBCBCACCACCBCCACBCCACCCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6136 wrote to memory of 2344	6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe	91
PID 2344 wrote to memory of 4140	2344	cmd.exe	93
PID 976 wrote to memory of 5100	976	svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe	94
PID 6136 wrote to memory of 2724	6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe	97
PID 2724 wrote to memory of 4492	2724	cmd.exe	99
PID 6136 wrote to memory of 4220	6136	2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe	100
PID 4220 wrote to memory of 1556	4220	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b38040ec356ad9303b54fd7c48b672c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCCBAAACBBBCCBBABAAAACCACBABBABBACCABCBCBBCBBABBBABCBBBCBBBABACCBCBCCCCCACCAABACACCCBCABCACBBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCCBAAACBBBCCBBABAAAACCACBABBABBACCABCBCBBCBBABBBABCBBBCBBBABACCBCBCCCCCACCAABACACCCBCABCACBBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe" start= auto displayName= "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe" start= auto displayName= "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBABABBBCBAACCBCBACACCBACAABCCCCACBAABAAAABABCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCABBABCAACBCABAAACCBCCCBCBCACCACCBCCACBCCACCCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCABBABCAACBCABAAACCBCCCBCBCACCACCBCCACBCCACCCAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
1⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcb092bb14c6c93242d101b895b260aab984d9a0802bd98a80d5ad8cec6a31a4
MD5 89e306aaead91dfa484dee1df622201f
SHA1 65a39b6b9dcbd8dee0fbe7737a87060b67ca07aa
SHA512 824d4ce978eaee480c8080896d829ef6c89444a20e8171547fd504ec961068ba26219d77ff3e5dfa8c07a0c130bde57ed8e6d13e16770bd165b93298f73cd325
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd40ab2dd59b4b4ef632d5bec11138107d636a91d60dcedc846110286c1d3e69
MD5 8970a77459efb2a6b40e9bb80ee24a6d
SHA1 9203de294bceeade3a4994a17b2717705ad0f846
SHA512 867a12e8d148661942ee7f058ce852c988a2a483b4edfff9536254db20c5e09d4b58813c162ee7a337893e9951afeb6c627415a635df3965ad12f4eec927dadd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e340480d1cfac617f68c91bf20cf5402aeb21665bcd2f8264d4112acc8cfbae8
MD5 00ce0781dd07e0402cf4e4cf63d3e467
SHA1 355a8febd49d00bef2f801b9d280e9ea482a6dbb
SHA512 98b13971dc9cd91141adcaf99c7fff77c70d503a43d42d5d6e007239c528338cfaddd4cb478953738ecd4499b0c24bcdda8a9c6f57c609c4c9dddaeb5ab71094
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2b85b88b55b261c94b005354cb600c581411494b41c318602e667e02e2c56fa5
MD5 8e290d8e6ad7bb3cb580356a94ea0035
SHA1 5e623b1bf161c908ab3360c378325ecb433de87d
SHA512 a0eb20b961ccbf36b7f22dfe54b7b6f598b99549eda2ae548645408bcba523f945ebb78a4bcb8feb7e91c21248966476d51f9dd76290ddce5ea3e8f2186f7605
MD5 SHA1 SHA512

Submit Download

svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABCCCBBBABBAAABACAABCBCAACBCABACBBCBABCACBCCAAABC.exe
Size 6.8MB
SHA256 0f3c60daa3a6301cf425a902eca62e87735299b9de4d309fe0c6abb39f85f5d2
MD5 1b38040ec356ad9303b54fd7c48b672c
SHA1 f3f6c66ff5aae8a89766c2e0f9884a03d3be4fb1
SHA512 c4e91376e755a0bb073569ac07cf157199a5cdff9e43ff1fced794784fa787478687a8b389b7e29419666f346c38a70c70a53e63699cde82c1bf4c868706f1ff
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+ELhOO+EF+Ei+EF+Ei+EF+ELhOO+EF+Ei+EF+Ei+EF+ELhOH:evvvvvvvva
TLSH
T186763A0DF99704F1D937517048DBD2BA8931793187218EEFF689C63EA933B91A838B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-24-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/976-34-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/6136-0-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/6136-8-0x0000000000050000-0x0000000000071000-memory.dmp

Download